Contexts and file labels: ls -Z, semanage fcontext and restorecon

Reading a context

$ ls -Z /var/www/html/index.html
unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/index.html
$ ls -Zd /home/asha
unconfined_u:object_r:user_home_dir_t:s0 /home/asha
$ ps -eZ | grep httpd | head -1
system_u:system_r:httpd_t:s0      1301 ?        00:00:00 httpd
$ id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

A context has four parts separated by colons: SELinux user (system_u), role (object_r for files), type (httpd_sys_content_t), and level (s0, used for multi-level security). In the targeted policy, decisions are made almost entirely on the TYPE. So when people say "the label is wrong", they usually mean the type.

Where do file labels come from?

The policy contains a database of rules that map paths to types: /var/www(/.*)? should be httpd_sys_content_t, /home/[^/]+ should be user_home_dir_t, and so on. New files normally inherit the type of the directory they are created in. restorecon resets files to what the database says.

The classic problem: content in a custom folder

# mkdir /web
# echo "Namaste" > /web/index.html
# ls -Z /web/index.html
unconfined_u:object_r:default_t:s0 /web/index.html
# (DocumentRoot set to /web in httpd.conf, httpd restarted)
$ curl http://localhost/
<title>403 Forbidden</title>

The right fix: semanage fcontext + restorecon

# semanage fcontext -a -t httpd_sys_content_t '/web(/.*)?'
# restorecon -Rv /web
Relabeled /web from unconfined_u:object_r:default_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
Relabeled /web/index.html from unconfined_u:object_r:default_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
$ curl http://localhost/
Namaste

semanage comes from the policycoreutils-python-utils package. Find the type you need by looking at the default location: ls -Zd /var/www/html shows httpd_sys_content_t. semanage fcontext -l | grep /var/www lists the existing rules for that path. Use httpd_sys_rw_content_t if the web app must WRITE there (uploads).

chcon: temporary only

chcon -t httpd_sys_content_t /web/index.html also changes a label, but it does not touch the database. The next restorecon, or a full relabel, puts the old label back. Use chcon only for a quick test; always finish with semanage fcontext.

Copy versus move

A very common real-world bug: a developer builds a page in their home directory and mv's it into /var/www/html. It keeps user_home_t, and httpd gets "403 Forbidden". restorecon -Rv /var/www/html fixes it.

Common mistakes

• Using chcon and thinking it is permanent.
• Writing the semanage pattern without quotes, or as /web/* instead of '/web(/.*)?'. The pattern is a regular expression.
• Running semanage fcontext and forgetting restorecon. The rule exists but existing files keep their old label.
• Changing normal permissions to 777 to fix an SELinux denial. It does not help and adds a new hole.